KR102545488B1 - Security Managing Method For Industrial Control System To Detect DLL Injection - Google Patents

Abstract

As a security management method for an industrial control system that detects DLL injection, the step of activating a security mode for detecting DLL injection in order to defend against a DLL injection attack to interfere with the control logic of an industrial control system, a protected target using inline hooking Monitoring the call status of the DLL load API function generated in the process of identifying the caller who called the DLL load API function, and based on the identified caller, if it is determined to be a malicious DLL injection attack attempt, using the DLL injection Recognizing it as a cyber attack and suspending the DLL load API function call.

Description

Security Management Method For Industrial Control System To Detect DLL Injection}

The present invention detects DLL injection, which pre-detects and blocks an attack technique called DLL injection to interfere with control logic, as one of cyber attacks targeting industrial control systems (ICS) adopted in large-scale industrial facilities including power systems. It relates to a security management method for an industrial control system.

Industrial control systems (ICS) are applied in various types to electricity, water and wastewater, petroleum and natural gas, chemicals, pharmaceuticals, pulp and paper, food and beverage, and manufacturing of individual items (automobiles, aerospace and durable goods, etc.). It is a concept that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLCs) that can be found in sectors and critical infrastructure.

Cyber attacks targeting industrial control systems (ICS) are increasing day by day. In a malicious cyber attack, an attacker can monitor or manipulate control commands of legitimate users using the process, and the attacker can abuse the access rights granted to the process. In one of these cyberattack cases, an attacker inserts a malicious DLL into the Internet banking program process, monitors the financial transaction processing logic, and leaks the transaction information entered by the Internet banking user to the outside. Another example is attacking a uranium enrichment facility. Malicious codes such as Black Energy 3, which attacked a Stuxnet or a power grid's synchrophasor-based real-time control system, attacked SCADA systems, resulting in actual attacks in which hackers seized control of industrial facilities.

However, previously published studies and international standards related to the security of industrial control systems (ICS) (e.g., IEC 61850 in substation automation systems (SAS)) are fundamental to security or network separation in terms of network communication. It has been pointed out that it is still at the level of discussing security principles, and that it is insufficient and vulnerable to complex attack methods in the real world that exploit the computer system itself in this way.

[Document 1] Korean Patent Publication No. 10-2019-0001325 (published on January 4, 2019) [Document 2] Korean Patent Registration No. 10-2139140 (registered on July 23, 2020)

doesn't exist

In the case of cyber attacks on industrial control systems adopted in large-scale industrial facilities including power systems, an attack technique called DLL injection is being used. For example, malware is using an attack technique called DLL injection to interfere with the control logic of a Microsoft Windows-based SCADA control system. Accordingly, there is an urgent need for a method for mitigation of security threats in the host system aspect of the industrial control system.

An object of the present invention is to provide a security management method for an industrial control system that detects DLL injection, which can improve the security level of the industrial control system by monitoring DLL logic API functions through inline hooking and detecting DLL injection attack attempts in advance. is in providing

This research was supported by the Korea Electric Power Corporation's 2018 basic research and development project research fund. (Task number: R18XA01)

To achieve the above object, a method for managing security of an industrial control system for detecting DLL injection according to the present invention includes (a) security for detecting DLL injection to prevent DLL injection attacks for interfering with the control logic of the industrial control system. activating the mode; (b) monitoring the call state of the DLL load API function generated in the process to be protected by using inline hooking, and identifying the caller who called the DLL load API function; and (c) recognizing it as a cyberattack using DLL injection and suspending the DLL load API function call if it is determined that the malicious DLL injection attack is attempted based on the caller identified in step (b). to be

In addition, the step (b) collects the return address stored in the stack area of the process memory when the DLL load API function is called, and identifies the caller by comparing the collected return address with the memory address allocated to the process memory. do.

In addition, the malicious DLL injection attack attempt in step (c) is characterized in that it is any one of an attack attempt using a remote thread, an attack attempt using an APC call, and an attack attempt using a Windows hook.

The present invention can detect and block malicious DLL injection attack techniques in advance by collecting the return address that called the DLL load API function and identifying the calling subject, thereby improving the security level of the industrial control system.

1 is a diagram briefly showing the process of loading an arbitrary DLL in a Microsoft Windows system;
2 is a diagram for explaining a normal DLL load attempt;
3 is a diagram for explaining an attempt to load a DLL using malicious DLL injection;
4 is a diagram showing a normal Win32 API calling process;
5 is a diagram showing a process of calling an inline-hooked Win32 API;
6 is a diagram for explaining an operation of detecting a caller of a DLL load API function that a DLL injection detection unit attempts DLL injection in a process memory to be protected according to an embodiment of the present invention;
7 is a diagram for explaining a return address of a calling subject stored in a stack area immediately after calling a function of a window application program;
8 is a flowchart illustrating a security management method of an industrial control system for detecting DLL injection according to an embodiment.

Hereinafter, the present invention will be described by describing embodiments of the present invention with reference to the accompanying drawings. Like reference numerals in each figure indicate like elements. In addition, in describing the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

DLL (Dynamic Link Library) is an executable file that corresponds to the concept of a shared library in Microsoft Windows. It exports functions that can be used in other programs, and calls them after loading the DLL in other programs to use them. can

As shown in FIG. 1, in the process of loading an arbitrary DLL in the Microsoft Windows system, the PE loader loads the DLL into an MMF (memory map file) according to the DLL load API function call command (S10) (S20), and then The DllMain callback function of the loaded DLL is called (S30). In this way, when a DLL is loaded in an arbitrary process, the DllMain function of the loaded DLL is called within the context of the process. This is the background of a code injection technique called DLL Injection, in which an attacker somehow loads a desired DLL into a targeting process and performs arbitrary actions in the context of that process. It is an attack technique that aims to perform. For example, malicious codes targeting SCADA systems continue to attack using DLL injection technology in the process of interfering with the core control logic of SCADA systems.

One case of trying to load a normal DLL is static load that calls the DLL load API function when the program starts as shown in FIG. It can be classified as dynamic load, which calls the DLL load API function during execution.

On the other hand, one case of maliciously trying to load a DLL using DLL injection is an attack attempt to create a remote thread as shown in FIG. 3 (a), and another case is a Windows hook (as shown in FIG. 3 (b)) Windows Hook) installation, and another case can be classified as an attack attempt by APC (Asynchronous Procedure Call) call setup as shown in FIG. 3 (c).

Referring to FIG. 6 , the memory structure of the process memory 100 includes an area allocated for an executable file having an *.exe extension and a library module having a *.dll extension loaded in the process, and a memory-mapped file (memory-mapped file). It is allocated to file, MMF) area, and private area for users.

Examples of malicious attack attempts (Fig. 3 (a) (b) (c)) occur at run-time, and as shown in Table 1, the caller calling the DLL load API function different. This caller can be confirmed by checking the information of the stack area allocated to the process memory 100 . 2 (b) also occurs during program execution, but since the caller is located in the code area of the process memory 100, it can be distinguished from a malicious attack attempt.

Remote Thread Windows Hooks APC caller kernel32.dll user32.dll ntdll.
Disassembly
(Win 10)
CALL [756A1F88]
CALL ESI
PUSH EAX

PUSH DWORD [EDI+IC]
CALL [768E4308
MOV ESI, EAX]

MOV ECX, [EBP+8]
CALL [EBP+8]
MOV DWORD [EBP-4], -2

In the embodiment, the DLL injection detection unit 200 detects malicious attack attempts using DLL injection in advance. The DLL injection detection unit 200 attempts a malicious DLL injection attack at run-time by identifying the caller of the DLL load API function that attempts DLL injection in the protected process memory 100. can detect This will be explained in detail.

In the normal Win32 API calling process in FIG. 4, the actual function (INSTR) is immediately executed according to the API function call of the user application, but in the inline hooked Win32 API calling process in FIG. 5, before the actual function (INSTR) is called. You can use the Detour Function to replace a specific function or block the call itself. By applying this inline hooking, the DLL injection detection unit 200 monitors the call state of the DLL load API function generated in the process to be protected.

Referring to FIG. 7 , the return address of the calling subject is stored in the stack area immediately after the function call of the Windows application program operating in the IA-32 architecture. Since the stack area includes the return address information of the calling subject, the DLL injection detection unit 200 obtains the memory address of the calling subject (caller) based on this return address information, and makes a call according to the obtained memory address. The subject (caller) can be identified. If the memory address of an arbitrary caller is known, information on the type of memory area to which the memory address belongs can be acquired using API functions called VirtualQuery/VirtualQueryEx. Here, if the memory address belongs to the memory area of a certain module, the memory address range of the module loaded into the process for the first time does not change, so it is possible to recognize whether the corresponding module is the caller attempting a malicious attack through comparison of memory addresses. . For example, if a module called user32.dll is loaded at a memory address (0x76000000 ~ 0x76FFFFFF), the memory address of the calling subject found through the return address of the stack area compares the memory address range, and the calling subject is user32.dll cognition can be identified.

In this way, the present invention monitors DLL logic API functions through inline hooking and detects DLL injection attack attempts in advance in order to defend against DLL injection attack techniques.

Hereinafter, a security management method of an industrial control system for detecting DLL injection according to an embodiment will be described in detail.

First, a security mode for DLL injection detection is activated for the industrial control system (S100). Accordingly, the DLL injection detection unit 200 monitors the call state of the DLL load API function generated in the process to be protected using inline hooking. At this time, when the DLL load API function is called, the DLL injection detection unit 200 collects return addresses from the stack area of the process memory 100 and compares the collected return addresses with the memory addresses allocated to the process memory. A caller is identified (S110).

Then, the DLL injection detection unit 200 determines whether the caller attempts an attack using a remote thread (S120), determines whether the caller attempts an attack using an APC call (S130), or determines whether the caller attempts an attack using an APC call (S130). It is determined whether (caller) is an attack attempt using a window hook (S140).

If it is determined that the caller is an attack attempt using a remote thread in step S120, an attack attempt using an APC call in step S130, and an attack attempt using a Windows hook in step S140, DLL injection detection unit In step 200, calling a DLL load API function is suspended by recognizing it as a cyber attack using DLL injection (S150).

Meanwhile, if any one of the steps S120, S130, and S140 does not correspond to the attack attempt, it is recognized as normal and the DLL load API function is called (S160).

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be.

100: process memory
200: DLL injection detection unit

Claims (3)

(a) activating a security mode for DLL injection detection to prevent DLL injection attacks for interfering with the control logic of the industrial control system;
(b) The DLL injection detection unit 200 monitors the call state of the DLL load API function generated in the process to be protected using inline hooking, and when the DLL load API function is called, stored in the stack area of the process memory 100 Collecting the return address and comparing the collected return address with the memory address allocated to the process memory to identify the caller who called the DLL load API function; and
(c) recognizing it as a cyberattack using DLL injection and suspending the DLL load API function call if it is determined that the malicious DLL injection attack is attempted based on the calling subject identified in step (b); A security management method for industrial control systems that detects DLL injection.
delete According to claim 1,
In step (c), the malicious DLL injection attack attempt is any one of an attack attempt using a remote thread, an attack attempt using an APC call, and an attack attempt using a Windows hook Industrial control system for detecting DLL injection security management method.

Images